The contribution here is narrow and real: corporate Atlassian instances behind SSO often cannot issue API tokens at all, and this makes them reachable by carrying the cookies your browser already has. The CLI-and-server split exists because the earlier design opened the login browser from inside the server and deadlocked tool calls for minutes — worth knowing, because it explains why you log in separately rather than on demand.
A wrapper around the upstream mcp-atlassian toolset that swaps token authentication for browser-cookie authentication via Playwright. It is aimed squarely at Atlassian Server and Data Center instances sitting behind Okta, SAML or similar, where the usual API token simply does not exist. Login and serving are deliberately separate processes: you authenticate once with a CLI in the foreground, and the server thereafter only reads the saved cookies.
- `atlassian_login` — the login tool registered by the server itself
- The upstream mcp-atlassian tool surface for Jira and Confluence, reached through patched clients that inject the browser-cookie session, so you get parity with the wrapped toolset rather than a reduced subset
- A command-line front end over the same auth core for scripting: log in per service, then fetch a Jira issue with its comments, run a JQL search, or get a Confluence page as Markdown
- Fail-fast behaviour on a missing or expired session: the server raises rather than blocking a tool call while it waits for an interactive login
- Separate cookie jars for Jira and Confluence sharing one browser profile, and an option to seed that profile once from your real Chrome profile so the first login is often one click
A Jira or Confluence account you can log into through your identity provider, plus `JIRA_URL` and `CONFLUENCE_URL` — both required. Python 3.11 or higher and `uv`; the launcher script creates the virtualenv, installs dependencies and starts the server. Chromium is installed by Playwright. A graphical display is required for the interactive SSO login, so the first login must happen on a machine with a screen — headless environments are a documented failure mode. `ATLASSIAN_LOGIN_TIMEOUT_SECONDS` defaults to 300, `ATLASSIAN_SSO_MARKERS` covers Okta, ADFS, Azure AD, PingOne and Google SAML by default, and `TOOLSETS` controls which upstream toolsets are enabled.
Build from source — clone the repository and build it, then point your client at the binary